01 — Why now
Open source carries the value creation. It is not being measured.
Over 90% of modern software value creation relies on open source. Nevertheless, maintainers and foundations make decisions about roadmap, sunset, and funding largely based on intuition.
The blind spot
What is measured today — and what is not.
The established metrics are not wrong. They just measure something different than the questions being asked.
Is measured — counts package transfers, including CI runs and mirror traffic.
Is measured — a star is a bookmark, not evidence of productive use.
Is not measured systematically by anyone.
Is not measured systematically by anyone.
Fills the two dashed lines — as Open Data, on multiple independent mirrors.
The bars are qualitative: they show whether a metric is captured, not how high it is.
Consequence
Three tools, three different answers to the same question.
NPM Downloads
Count packages that were downloaded. They say nothing about whether the library was ever executed — including CI runs and mirror traffic.
GitHub Stars
Count attention, not adoption. A star is a bookmark, not evidence of productive use.
Prometheus
Measures reach and usage duration — verifiably anonymous, as Open Data, on multiple independent mirrors, verifiable via a public audit log.
Who suffers from it
The blind spot has a concrete cost.
Maintainers decide without data
Whether to sunset a module or introduce a breaking change can only be estimated without usage data.
Foundations fund by visibility
Funding flows to where attention is — not necessarily to where critical infrastructure lies.
Vendors don't know their dependencies in depth
Without reach insight, supply chain risk remains a list of package names rather than a reliable assessment.
Research builds custom crawlers every time
Every study starts with the same data procurement — not reproducible, not comparable, not shared.